Loytec L-INX CVE-2026-12503

Requires an authenticated foothold as the larmapp account (or membership in the larmapp group) with the ability to write to /etc/lighttpd/ssl/server.pem on a LINX-A64 device running firmware ≤8.4.16, plus the ability to cause /usr/bin/larm_starter to run its chown/chmod on that path. It is not remotely exploitable without prior access (AV:L, PR:H) and needs no user interaction. Limiting factors: attacker must already control the larmapp account, the device must be one of the listed Loytec models on the LINX-A64 platform, and exploitation is local-only - CISA SSVC rates it as not automatable.

This is a genuine full-compromise local privilege escalation (SSVC technical impact 'total'; assessed CIA all High) but its real-world urgency is bounded. The CVSS 4.0 vector is AV:L/PR:H, meaning the attacker must already hold a valid larmapp foothold on the device - it is not remotely reachable without prior access. EPSS is only 0.14% (3rd percentile) and CISA SSVC rates exploitation as 'none' and automatable as 'no', and no public exploit code was identified, so this is a high-impact-but-low-immediate-likelihood issue rather than an actively-exploited emergency. The signals are internally consistent: high CVSS (9.2) is driven purely by the total technical impact, not by ease or reach of exploitation. Priority should be treated as a firmware-maintenance item for exposed/critical BAS deployments, escalating if an attacker could plausibly obtain the larmapp account (e.g. via a separate web/app-layer flaw chaining into this one).

An attacker who has obtained the constrained larmapp service account (for example by leveraging a separate web-application weakness on the controller) replaces /etc/lighttpd/ssl/server.pem with a symbolic link pointing to /etc/passwd. When the privileged larm_starter helper next adjusts ownership/permissions on that path, /etc/passwd becomes writable by the larmapp group; the attacker then edits it to grant themselves a UID-0 account and gains full root control of the building-automation device. No public exploit is known, and the attack requires local, authenticated access (CVSS AV:L/PR:H).